diff --git a/.github/workflows/ci-docker.yml b/.github/workflows/ci-docker.yml
new file mode 100644
index 00000000..1d5dfbe9
--- /dev/null
+++ b/.github/workflows/ci-docker.yml
@@ -0,0 +1,33 @@
+name: Build and Publish Docker Image
+
+on:
+  push:
+    branches:
+      - '*'
+    paths:
+      - 'snitch/docker/Dockerfile'
+  pull_request:
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v2
+
+      - name: Set up Docker Buildx
+        id: docker-buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Build and Push Docker Image
+        run: |
+          docker buildx build -t ghcr.io/${{ github.repository_owner }}/snitch-toolchain:${{ github.sha }} -f snitch/docker/Dockerfile .
+          docker push ghcr.io/${{ github.repository_owner }}/snitch-toolchain:${{ github.sha }}
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            docker buildx imagetools create ghcr.io/${{ github.repository_owner }}/snitch-toolchain:${{ github.sha }} --tag ghcr.io/${{ github.repository_owner }}/snitch-toolchain:latest
+            docker push ghcr.io/${{ github.repository_owner }}/snitch-toolchain:latest
+          else
+            echo "Not on the main branch, skipping push to latest tag."
+          fi
+
diff --git a/docker/Dockerfile b/docker/Dockerfile
index c87a6d67..3e3dae2a 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -96,6 +96,9 @@ deb-src http://apt.llvm.org/bionic/ llvm-toolchain-bionic-16 main\n" >> /etc/apt
 
 # Make our own python3.11 available for current $USER:
 ENV PATH "/opt/python3.11/bin:${PATH}"
+# Env variable that forces venv environment creation in the entrypoint when set
+ENV FORCE_VENV=0
+ENV TODO_VAR=0
 
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]